Microsoft, suspecting NSA spying, to ramp up efforts to encrypt its Internet traffic
Microsoft is moving toward a major new effort to encrypt its Internet traffic after concluding that the National Security Agency may have broken into its global communications systems, said people familiar with the emerging plans.
Context & Ripple Effects
Four months after the Guardian reported Microsoft gave the NSA access to encrypted messages, the company has reached its own darker conclusion: people familiar with the plans tell the Washington Post it suspects the agency broke into its global communications systems outright. The response is a major new effort to encrypt Microsoft's internal Internet traffic.
The story traveled fast — The Verge, CNET, ZDNet, Gigaom, VentureBeat, The Next Web, Softpedia and I4U all picked it up the same day — reflecting how directly it lands on the cloud industry's most sensitive nerve since the summer's surveillance disclosures: whether US providers can assure customers their data paths are not compromised by their own government.
First-order effects
- Microsoft must re-engineer encryption across the links between its datacenters, a costly retrofit of infrastructure built on the assumption that internal traffic was safe.
- The suspected intrusion converts a public-relations problem into an engineering mandate: Microsoft is now designing its network as if the NSA were an adversary rather than a partner.
Second-order effects
- Rival cloud operators face pressure to match whatever Microsoft announces, making transport-layer encryption table stakes rather than a differentiator in enterprise cloud sales.
- Foreign government and enterprise buyers of US cloud services gain concrete grounds to demand verifiable encryption guarantees, shifting procurement criteria toward providers who can prove their pipes are sealed.
Third-order effects
- If the pattern holds, US intelligence access and US cloud competitiveness become formally opposed objectives, forcing a policy reckoning over how far agencies may tap provider infrastructure without destroying the export market for American cloud services.
- Default end-to-end or transport encryption across major platforms would degrade bulk interception as a technique, pushing intelligence agencies toward endpoint exploits — a shift whose regulatory consequences remain unresolved.
The trend: In the wake of the 2013 surveillance disclosures, US cloud providers are reclassifying government interception as a threat model and moving toward always-on encryption of their internal traffic.